Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads Sample Questions:

1. Your organization plans to allow developers to access Azure OpenAI resources. Management wants to ensure that access permissions follow the principle of least privilege. What should you use?

A) Resource locks
B) Management groups only
C) Azure Policy exemptions
D) Role-Based Access Control (RBAC) roles

2. A security team wants to identify unusual prompt activity against an Azure AI application. The team needs centralized visibility and advanced threat detection capabilities. Which Microsoft solution should be used?

A) Azure ExpressRoute
B) Microsoft Sentinel
C) Azure DNS
D) Azure Bastion

3. Drag and Drop Question
You have a Microsoft Entra tenant.
You need to implement passwordless authentication. The solution must meet the following requirements:
- Users can sign in without a password by using a mobile device.
- New users that sign in for the first time must use a helpdesk-issued
sign-in method that expires.
Which authentication method should you enable for each requirement? To answer, drag the appropriate methods to the correct requirements. Each method may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.

4. Hotspot Question
You have an Azure subscription named Sub1 that contains 50 virtual machines. Sub1 has Microsoft Defender for Cloud enabled.
Sub1 contains an Azure key vault named KV1 and an Azure policy that enforces storing all secrets in KV1.
Occasionally, the developers at your company store plaintext tokens and SSH private keys on the virtual machines.
You need to configure Defender for Cloud to detect plaintext secrets on the virtual machines. The solution must minimize administrative changes to the virtual machines.
How should you configure Defender for Cloud? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

5. Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have an Azure subscription that contains two virtual machines named VM1 and VM2. Each virtual machine has system-assigned managed identity enabled.
You have an Azure Storage account named storage1. Public access from all networks is enabled for storage1.
You need to ensure that VM1 and VM2 can access storage1.
Solution: You create a user-assigned managed identity, assign the identity to each virtual machine, and then add each managed identity to a role on storage1.
Does this meet the goal?

A) Yes
B) No

Solutions: